Hewlett Packard Enterprise Development LP

Google Inc.

Aruba Networks, Inc.

Microsoft Technology Licensing, LLC

Hao Lu

Yang Li

Sachin Ganu

Nitin A Changlani

Yan Liu

Mohd Shahnawaz Siraj

Chunfeng Wang

Feng Ding

Haifeng Zhang

Kannan Konath

Rahul Bahal

Xiaoding Shang

Qiang Zhou

Stephane Laroche

Jikui Pei

Mohan Ram Bhadravati Ramakrishna Bhat

Qiwei Chang

Steven Mark Drucker

Pradeep Iyer

Wei Peng Huang

Yang Wang

Jianpo Han

Gonzalo Alberto Ramos

Danyel Aharon Fisher

Sumit Basu

Raghunandan Prabhakar

Shravan Kumar Vuggrala

Rajini Balay

Zhijun Ren

Guojun Zhang

Longping Xia

Vivek Batra

Xuanhe Zhang

Mohan Ram R Bhadravati

Hong Song

Uran Oh

Ji-kui Pei

In some examples, as part of an authentication process for an electronic device when connecting to a first access point (AP), an authentication server generates a first key of a hierarchy of keys. The authentication server receives a request from a second AP, and generates a second key based on the first key, the second key being part of the hierarchy of keys. In response to the request, the authentication server distributes the second key from the authentication server to the second AP for use in data protection for communications between the second AP and the electronic device after the electronic device has transitioned from the first AP to the second AP.

Key distribution from an authentication server

An access point (AP) in an AP cluster is provided. During operation, the AP can identify a set of Internet Protocol (IP) addresses of permitted devices in a virtual local area network (VLAN) of the AP cluster from a first set of packets. The AP can also identify a set of media access control (MAC) addresses corresponding to the set of IP addresses from a second set of packets. The AP can then generate a whitelist comprising the sets of IP and MAC addresses. The whitelist can indicate addresses of packets permitted to be forwarded via the wireless interface. The AP can identify a target IP address in an Address Resolution Protocol (ARP) request. If the target IP address is absent in the whitelist, the AP can preclude the wireless interface from forwarding the ARP request to clients wirelessly coupled to the wireless interface.

Intra-VLAN traffic filtering in a distributed wireless network

One aspect can provide a system and method for emulating the onboarding of networking devices. During operation, a computing device can obtain from a device-activation platform a list of networking devices to be onboarded to a device-management platform method. For a respective networking device on the list of networking devices, the system can collect hardware and firmware information associated with the respective networking device and emulate an onboarding process of the respective networking device using the collected hardware and firmware information, which comprises exchanging one or more handshake messages with the device-activation platform. In response to failing to receive, from the device-management platform, a confirmation message indicating the emulated onboarding process being successful, the system can perform a diagnostic operation to determine one or more potential issues associated with the onboarding process of the respective networking device and display, on a user interface, outcome of the diagnostic operation.

Device onboarding assurance

An AP sets up a data tunnel to a remote network and monitors a remote DHCP session between a client device and a remote DHCP server in the remote network. The remote DHCP server assigns a remote IP address to the client device, and communication between the client device and the remote network is based on the remote IP address. In response to determining completion of the remote DHCP session, the AP initializes a local DHCP session with a local DHCP server in a local network to obtain a local IP address for the client device. Communication between the client device and the local network is based on the local IP address. In response to detecting the client device roaming from the AP to a target AP, the AP forwards the remote and local IP addresses and session data of active sessions on the client device to the target AP.

Wi-Fi roaming support for cloud integrated remote WLAN deployment

Examples relate to configuring dynamic user roles that can be managed and distributed by a cloud-based user role service. In this way, dynamic user roles may be distributed in a more scalable manner than has been previously possible. Upon associating or connecting to an access point (AP), for example, a user device can be authenticated and assigned a user role. The AP can request the user role configuration from the cloud-based user role service. The cloud-based user role service can additionally distribute the same user role configuration/details to all neighboring APs. In this way, a user device can move, roam, or otherwise associate to another AP that post-distribution, already has the (dynamic) user role configuration, which can simply be applied to the user device.

Cloud-orchestrated role management for WLAN

Examples described herein relate to a method for establishing a backup connectivity between a sensor and a management system. The sensor may be deployed in an IT infrastructure and configured to execute a one or more predetermined evaluations for the IT network and generate corresponding evaluation result. Thereafter, the sensor may determine whether a connection between the sensor and the management system via a primary connectivity is unsuccessful. In response to determining that the connection between the sensor and the management system via the primary connectivity is unsuccessful, the sensor may establish a backup connectivity by successfully connecting to an available wireless network using a security credential received by the sensor upon successful verification of public key information of the sensor via an authentication server. The sensor then transmits the evaluation result to the management system via the backup connectivity.

Establishing a backup connectivity between a sensor and a management system

Examples include scanning for cellular channels from various cellular service providers. Identifying cellular channels corresponding to cellular service providers. Recording a set of operating parameters for the cellular channels. Evaluating the cellular channels based on the set of operating parameters. Sorting the cellular service providers based on the evaluation of the cellular channels.

Evaluating cellular channels

Systems and techniques are described that are directed to intelligent scheduling of Wi-Fi services for applications, including enhanced dynamic prioritization. A device, such as an access point (AP), can receive data packets from multiple connected devices to dynamically identify an application flow for each data packet, and dynamically identify a user associated with the application flow for each data packet. The AP can generate prioritized candidate lists for selected data packets in queues corresponding to an access category (AC). In response to determining that the identified user associated with the application flow corresponds with a critical user, the AP can select data packets for the prioritized candidate lists based at least in part on priority policies for each of a plurality of applications and based at least in part on dynamic prioritization of applications for each of a plurality of applications; and schedule data packets from the prioritized candidate lists.

Methods and systems to dynamically prioritize applications over 802.11 wireless LAN

Systems and methods are provided for zero-touch provisioning of devices, such as sensors, on a network. When a device is unable/cannot access a network via Ethernet, cellular, or near field communications capabilities resident on the device, the device can alternatively be provisioned via an intermediate network device, such as an access point using, e.g., Device Provisioning Protocol or Wi-Fi EasyConnect. A cloud-based network management system may receive a device's bootstrapping information during or after manufacturing of the device. Ultimately, the device, via the intermediate network device, is able to communicate with a back-end, cloud-based network insight system from which configuration parameters for the device may be obtained.

Secure and adaptive mechanism to provision zero- touch network devices

Systems and methods are provided for discoverability detection of network services. The present disclosure provides for a cloud-based network insight server that collects performance information of a network and a network agent, communicating with the cloud-based network insight server, that monitors discoverability of network services hosted by devices on the network. The network agent receives configuration information from the cloud-based network insight server and transmits discoverability states of the devices to the cloud-based network insight server based on executing a service discovery process through an access point on the network.

Service reachability detection

Systems and methods for providing enhanced Quality of Service (QoS) network transmissions can be based on an application sub-class or a user class. Systems and methods can include inspecting the information packet having a network level QoS field having a first network level QoS portion and a second network level QoS portion, determining an application sub-class or user class associated with the information packet, tagging the first network level QoS portion of the information packet according to a first network level QoS value, tagging the second network level QoS portion of the information packet according to a traffic priority indication and to a determined application sub-class or user class, and queuing the information packet for transmission from a network element based on the tagged first network level QoS portion and the second network level QoS portion.

Consistent Quality of Service policy in a software defined enterprise

An example access point may comprise a processing resource; and a memory resource storing machine-readable instructions to cause the processing resource to: perform a management system search using a dynamic host configuration protocol (DHCP); determine, in view of the management system search, whether a management system discovered is a controller; and select one of a first role within a centralized local area network and a second role within a distributed local area network based on determining whether the management system is the controller, wherein the first role within the centralized local area network is selected when the management system is the controller.

Selecting a role for an access point

Systems and methods are provided for authentication chaining and firewall optimization in a micro branch deployment comprising a plurality of chained access points (APs) and a gateway AP. A topology of the micro branch deployment may be determined through enhanced hierarchical beaconing. Based on the determined topology, an authentication chain is developed through which a client device associated to an AP of the plurality of chained APs may be authenticated and granted access to the AP. Upon authentication of the client device, firewall optimization is performed to implement access control rules only at the AP to which the client device is associated.

Authentication chaining in micro branch deployment

Some examples relate to distributing application classification entries to network devices. An example includes receiving, by a processing resource in a cloud computing system, an application classification entry for an application from respective network devices on a network. The application classification entry may comprise a given application identifier for identifying the application and control information for routing a network packet originating from the application. For the given application identifier, the processing resource may generate a consolidated set of application classification entries, based on the application classification entry received from respective network devices. The processing resource may then determine appropriate network devices to distribute the consolidated set of application classification entries.

Application classification distribution to network devices

Systems and methods are provided for synchronizing uplink (UL) and downlink (DL) traffic. In particular, frames associated with Quality of Service (QoS}-sensitive traffic flows to be transmitted in a first direction are prioritized commensurate with frames to be transmitted in a second direction, different/opposite to that of the first direction. For example, UL traffic flows can be prioritized based on DL traffic flows, where the traffic flows belong to the same application flow, and vice versa, where DL traffic flows can be prioritized based on UL traffic flows for the same application flow. In this way, end-to-end QoS can be achieved.

Growing community of inventors

Santa Clara, CA, United States of America

Hao Lu